# Differential cryptanalysis - how to extend the attack to rounds before the last?

Suppose that we have a block cipher such that the last round of the cipher depends on half of the key and the penultimate round uses the other half. Suppose also that I attacked the last round using differential cryptanalysis and reduced my search space from 2^8 to 2 choices for each byte of that half of the key.

One way to conclude the attack would be to execute bruteforce on the remaining key space, but I would like to keep using differential cryptanalysis to attack also the penultimate round, to achieve better complexity than bruteforce.

As a comment to this question, the user "kelalaka" seems to hint at the fact that we can still use differential cryptanalysis to recover the key used in the penultimate round, as "the probabilities will be better". The user "kodlu", in the answer to the same question, says: "Then the rounds can be peeled off one by one as in the comments.", but then they do not describe how to do it.

Can someone explain to me how to extend the differential attack to the penultimate round, in the specific setting I mentioned or even in general? (the "key schedule" I gave is not particularly important but is just a way to say that we can't recover the full key by using only the last round key)

• Well, It should be clear. The more round the lower success of the attack. This is why the designers calculate and set their rounds as AES designers did. Once you attack to the last round, decrypt all the ciphertext for the last round, now, you have pairs for attacking the penultimate round with at least better probability. Yes, for AES-256 you need more than one round to recover the full key.. May 17 at 21:15
• Once the last round is broken, the rest is broken ( in the differential and linear attack case).. May 17 at 21:17

The intuition is certainly that the last rounds can be removed one by one. If a differential distinguisher allows us to recognize the $$n$$-th round key, then surely the differential nonuniformity after $$n-1$$ rounds that allowed us to do this will be even worse at round $$n-2$$, so clearly the same trick can be used to recover the round key for round $$n-1$$ and so on... right?
There are various other cases where the intuition fails that a technique that allows us to solve $$n$$ rounds will also allow us to solve $$n-1$$ rounds; for instance, in differential attacks the distinguisher used to break $$n$$ rounds could depend on a particular difference in round $$n-1$$ that transitions to round $$n-2$$ deterministically, in which case we gain no new information when we descend to round $$n-2$$, or dependencies in the key schedule could make the expected differential nonuniformity of a cipher go up instead of down as rounds are added (although admittedly, this last case happens only in pathological cases).